[eeturunen]

Yup. The GDPR is literally a regulation, not a directive. A directive is implemented into national law while a regulation is enforced as is and supersedes national legislation.